ReclaiMe Data Recovery Training

Filesystem Recovery Course - VMFS Recovery Test

What does payload contain?

up to 1024 pointers or file content
512 pointers to large clusters
256 pointers or file content
any file related data

Check what inode payload can store

128 pointers to large clusters and 128 pointers to small clusters
up to 256 pointers to small clusters
up to 256 indirect block pointers
128 pointers to small clusters and 128 indirect block pointers
file content for files less than 1 KB
up to 256 pointers to large clusters

Where is indirect blocks table stored on a VMFS volume?

in the beginning of the volume
in the end of the volume
one copy in the beginning and other – in the end

Where are the numbers of the first and the last segments stored?

in the extent header
in the volume header

What is the payload size?

8KB
512B
1KB
2KB

What is the typical size of large cluster?

32 KB
4 MB
1 MB
512 KB

What metadata is stored in an inode?

date and time of file creation, the file name, and the file type
date and time of file creation, the file size, and the file type
date and time of file creation, the file size, and file name

What parts are there in an inode?

metadata, segment numbers, and payload
metadata, parent pointers, and payload
metadata and payload

Carving doesn’t work well on a VMFS volume

true
false

What happens when a file is deleted?

metadata in the corresponding inode is overwritten with zeros
payload in the corresponding inode is overwritten with zeros
an entire inode is overwritten with zeros

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.